e5988cc800b00d273120c8e808abb0997f5a8f4c8c763fdaa0b7e0805cb8c9b6

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

759dac7c29f35a6971d77750098288a3_JaffaCakes118.html
Size

26KB
MD5

759dac7c29f35a6971d77750098288a3
SHA1

5dd6b3a471e531abfb2b1d3c166ad8bcc4780ce8
SHA256

e5988cc800b00d273120c8e808abb0997f5a8f4c8c763fdaa0b7e0805cb8c9b6
SHA512

e655d4e763e665ccb8d9ffab53977c75f67a164446c9ca56a816864470b508b8ac03f2f5c1f9dc990dadaf0185debb07c4dd998f98bc63810a51425d702f55ab
SSDEEP

192:uqjLjLb5n1zGnQjxn5Q/gnQiejNnXnQOkEntMWnQTbn5nQXCJVevo7Nt6Fo+NzQo:nHQ/FygcFR9Gl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47E4F741-1B67-11EF-A585-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422893454"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
340	iexplore.exe
340	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 3020	340	iexplore.exe	28
PID 340 wrote to memory of 3020	340	iexplore.exe	28
PID 340 wrote to memory of 3020	340	iexplore.exe	28
PID 340 wrote to memory of 3020	340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\759dac7c29f35a6971d77750098288a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
645d63383727c666278154b4689a662e

SHA1
a7d3af7ef44335bae0f5c4ee6d683be3a09b6f97

SHA256
add6b323bed590ecf16e8d82204c11534d6532ba18ea25fc6a0192003a14e4a8

SHA512
9717b976994de11be3252c81dce0230311bb7ed3a139b02e83978a243c5406840910dafeae37b9b34083bc0a183944e79707a7d2b53053f4ea64655433c88141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66b5e89d0621a8a1445cb4ea1d42fafe

SHA1
ba4789cc4ae195b3ed96530b413644eff532c7d2

SHA256
e8878286fb2776f200225aafee0da336024591fa7ada6c4cd7f00f4bd2ccb2ef

SHA512
62b0e4b351fcaba56e108b2f5ac3ac15257724750b5292c7204bc2080e2871e0077de25a34d51c2863a826d5a6c12323020acbab0a1b2e6631df910a55382da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
625f450e1c4d43e9318b938663d0c2bb

SHA1
cc97305bcb4d09eee8853c4308d8026f97315b7c

SHA256
f50513bd52e8cbb6ddfd6cba565949fa3d08f416afaf19ed590cd5993d206d9c

SHA512
ddb39e584e76826321641bb21aae2421105db0d0e6478f430029b028cc99e70c2714391603ee000a88e5b928e6e36c44a68467b9169a1869010c597b90a14b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fea3c42deeb82605e079958e8680fe4

SHA1
2759f622d42f2ce80a6f48e4610792312ebcbf56

SHA256
a93eb595974c426e8d67c551e19d4cd204ffb5aef5bf6143c0a7ce4dc60f528a

SHA512
6d54916c674b9dce4876a84abfc1b1f339184ab3eb996af069a5efe8939641fa4d18cef10dbd9516c54f3273b59a6f7d4ac3e89c5355a51fed6ca5357c265154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc9c816826782874a620a45ff68076f

SHA1
9038b3d80d6bb72c0cbcbd90b3c7e5d489eb8981

SHA256
1ea745f58bb9bf22b44ef4147838efd8ea9ad8f25700b58aa13fdf45d344080a

SHA512
050e701bcf7f02a2f71239070ade46e3b5189fac4831bebb732fbe5bff9d328127ab24b361e6426e99bf77be565368cadc95f715a6c03892768719843afd2730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13161d773df3ed2d9aeb99969d830bca

SHA1
d8a7c1339482fd9f13bc12b2b90293326fdc2eba

SHA256
91f0dc52e214410db5002367510de6e52c699391f03f17ee0c079a040e761144

SHA512
9380a7d0a117a9e5f799d6905b42643ef67df53841de1eee401c5948819aaf2ccdecce6e8f5572be3ebe0a779faf6c43a30cd7da0414edccb0b52928cbec2946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a6be5fa0f966fd6d059bbf5d5de6e20

SHA1
cd59e1dad3676da6e38b0d51a40345b609898c02

SHA256
3702ae1410d3c5d5ddf5e8257504aa243539844f2df040ee1b969771cc3d1f59

SHA512
7ad81c68c0e32fc00ae67ca1cd4c32ce53e0ccda2fcbd54d1e3fe8ecfeb3786ed47bcbfca634d7f8fc01d39a03116cb9085773de9428379a106131c06f515de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17f963ec3c3b08a561375248b8eeccf3

SHA1
8e75d5edccd9d09fecdbc649b95d6a662728ec29

SHA256
0d9392127064081de861775f7edcdc0e2f38394908413a9ffc47eedc2d971b84

SHA512
10c19467094e93f7537871e7abeb217fffd85ecbabc33f2454d07bc73d99daef6f931547040430d69df99ab516cb6a4c733a80d336a1c5d3722170c400d28752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b32b110a44d620fe2523813016c91c0

SHA1
07bfc763595f9237aa23a4b8ad9bef8f5fae7fd9

SHA256
c3ee386649c310bdf07a2d0e2fc3a5624d8f9e79469769d491f5f35449e590f6

SHA512
f88f17246e3983ce82f4ec809f44f61ac577da99ef8b778927487e9da9ab981616cae5567e17ffc14ffc45e4a1b64ccbe797fad68e34f54dbb61ca5987c5a631

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF90.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit